Privilege Escalation via Insecure PID Check in Android ServiceManager

This repository contains a native Android C++ exploit/PoC binary, not a framework module. The project builds a binary named 'hwservice' from main.cpp and DummyService.cpp, with several generated-looking HIDL wrapper headers (BnHwDummyService.h, BpHwDummyService.h, BsDummyService.h, IDummyService.h, IHwDummyService.h) that support a fabricated HIDL service implementation. Repository structure: main.cpp is the primary entry point and orchestrates the exploit flow. It performs low-level Binder/HwBinder transactions against Android's hwservicemanager and token manager, including helper routines to find a hardware service, add/register a service, create or resolve tokens, and split execution into parent/child flows. DummyService.cpp implements the malicious/fake HIDL service object (IDummyService) and contains the core exploitation logic inside interfaceChain(), where it manipulates process lifecycle and triggers audio-service transactions to influence PID/service-manager state. The remaining headers are support code for the HIDL interface plumbing. The Makefile and Android.bp define Android/NDK builds, and the Makefile includes adb push/run helpers for deploying to /data/local/tmp/. Main exploit capability: the code attempts to register or replace a hardware service by abusing Android HIDL token management and hwservicemanager registration behavior. It directly invokes Binder transaction codes on IServiceManager (notably get/add style operations) and interacts with ITokenManager to obtain a binder from a token. The exploit then registers that binder under the 'default' service name. The fake service advertises itself as android.hidl.base@1.0::IBase rather than a legitimate custom interface, and even returns a fake hash chain, indicating deliberate service fabrication. Notable exploitation behavior: DummyService.cpp's interfaceChain() is weaponized as a trigger point. When called, it ensures sound effects are loaded via the 'audio' Binder service, kills a child process, waits for it, repeatedly forks to cycle process IDs toward a target PID, unloads and reloads sound effects, and sleeps to allow threads to spawn. Comments explicitly state the goal is to let system_server occupy a chosen PID so ACL checks pass, enabling service replacement. This strongly suggests a local privilege-escalation or service-impersonation exploit against Android's hardware service registration controls. There are no external network C2 endpoints, URLs, or IPs. The observable targets are Android Binder/HIDL interface names, service names, and local deployment paths. Overall, this is an operational local Android exploit PoC focused on Binder/HIDL service hijacking rather than remote exploitation.